Pullup ticket #4555 - requested by taca
www/drupal6: security update

Revisions pulled up:
- www/drupal6/Makefile                                          1.50
- www/drupal6/distinfo                                          1.33

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Nov 23 16:38:59 UTC 2014

   Modified Files:
   	pkgsrc/www/drupal6: Makefile distinfo

   Log Message:
   Update drupal6 to 6.34.

   Drupal 6.34, 2014-11-19
   ----------------------
   - Fixed security issues (session hijacking). See SA-CORE-2014-006.
Pullup ticket #4556 - requested by taca
www/drupal7: security update

Revisions pulled up:
- www/drupal7/Makefile                                          1.30
- www/drupal7/PLIST                                             1.11
- www/drupal7/distinfo                                          1.23

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Nov 23 16:40:10 UTC 2014

   Modified Files:
   	pkgsrc/www/drupal7: Makefile PLIST distinfo

   Log Message:
   Update drupal7 to 7.34.

   Drupal 7.34, 2014-11-19
   ----------------------
   - Fixed security issues (multiple vulnerabilities). See SA-CORE-2014-006.

   Drupal 7.33, 2014-11-07
   -----------------------
   - Began storing the file modification time of each module and theme in the
     {system} database table so that contributed modules can use it to identify
     recently changed modules and themes (minor data structure change to the
     return value of system_get_info() and other related functions).
   - Added a "Did you mean?" feature to the run-tests.sh script for running
     automated tests from the command line, to help developers who are attempting
     to run a particular test class or group.
   - Changed the date format used in various HTTP headers output by Drupal core
     from RFC 1123 format to RFC 7231 format.
   - Added a "block_cache_bypass_node_grants" variable to allow sites which have
     node access modules enabled to use the block cache if desired (API addition).
   - Made image derivative generation HTTP requests return a 404 error (rather
     than a 500 error) when the source image does not exist.
   - Fixed a bug which caused user pictures to be removed from the user object
     after saving, and resulted in data loss if the user account was subsequently
     re-saved.
   - Fixed a bug in which field_has_data() did not return TRUE for fields that
     only had data in older entity revisions, leading to loss of the field's data
     when the field configuration was edited.
   - Fixed a bug which caused the Ajax progress throbber to appear misaligned in
     many situatons (minor styling change).
   - Prevented the Bartik theme from lower-casing the "Permalink" link on
     comments, for improved multilingual support (minor UI change).
   - Added a "preferred_menu_links" tag to the database query that is used by
     menu_link_get_preferred() to find the preferred menu link for a given path,
     to make it easier to alter.
   - Increased the maximum allowed length of block titles to 255 characters
     (database schema change to the {block} table).
   - Removed the Field module's field_modules_uninstalled() function, since it did
     not do anything when it was invoked.
   - Added a "theme_hook_original" variable to templates and theme functions and
     an optional sitewide theme debug mode, to provide contextual information in
     the page's HTML to theme developers. The theme debug mode is based on the one
     used with Twig in Drupal 8 and can be accessed by setting the "theme_debug"
     variable to TRUE (API addition).
   - Added an entity_view_mode_prepare() API function to allow entity-defining
     modules to properly invoke hook_entity_view_mode_alter(), and used it
     throughout Drupal core to fix bugs with the invocation of that hook (API
     change: https://www.drupal.org/node/2369141).
   - Security improvement: Made the database API's orderBy() method sanitize the
     sort direction ("ASC" or "DESC") for queries built with db_select(), so that
     calling code does not have to.
   - Changed the RDF module to consistently output RDF metadata for nodes and
     comments near where the node is rendered in the HTML (minor markup and data
     structure change).
   - Added an HTML class to RDFa metatags throughout Drupal to prevent them from
     accidentally affecting the site appearance (minor markup change).
   - Fixed a bug in the Unicode requirements check which prevented installing
     Drupal on PHP 5.6.
   - Fixed a bug which caused drupal_get_bootstrap_phase() to abort the bootstrap
     when called early in the page request.
   - Renamed the "Search result" view mode to "Search result highlighting input"
     to better reflect how it is used (UI change).
   - Improved database queries generated by EntityFieldQuery in the case where
     delta or language condition groups are used, to reduce the number of INNER
     JOINs (this is a minor data structure change affecting code which implements
     hook_query_alter() on these queries).
   - Removed special-case behavior for file uploads which allowed user #1 to
     bypass maximum file size and user quota limits.
   - Numerous small bug fixes.
   - Numerous API documentation improvements.
   - Additional automated test coverage.
Pullup ticket #4557 - requested by taca
www/contao32: security update

Revisions pulled up:
- www/contao/Makefile.common                                    patch
- www/contao32/PLIST                                            1.9
- www/contao32/distinfo                                         1.16-1.17

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Nov  2 01:17:44 UTC 2014

   Modified Files:
   	pkgsrc/www/contao: Makefile.common
   	pkgsrc/www/contao32: PLIST distinfo

   Log Message:
   Update contao32 to 3.2.15.

   Version 3.2.15 (2014-10-31)
   ---------------------------

   ### Fixed
   Always pass a DC object in the `toggleVisibility` callback (see #7314).

   ### Fixed
   Correctly render the "read more" and article navigation links (see #7300).

   ### Fixed
   Consider the `useSSL` flag of the root page when generating URLs (see #7390).

   ### Fixed
   Fixed the FAQ sorting in the back end (see #7362).

   ### Fixed
   Added the `Widget::__isset()` method (see #7290).

   ### Fixed
   Correctly handle dynamic parent tables in the `DC_Table` driver (see #7335).

   ### Fixed
   Correctly shortend HTML strings in `String::substrHtml()` (see #7311).

   ### Updated
   Updated MooTools to version 1.5.1 (see #7267).

   ### Fixed
   Updated swipe.js to version 2.0.1 (see #7307).

   ### Fixed
   Use an `.invisible` class which plays nicely with screen readers (see #7372).

   ### Fixed
   Handle disabled modules in the module loader (see #7380).

   ### Fixed
   Fixed the "link_target" insert tag.

   ### Updated
   Updated the ACE editor to version 1.1.6 (see #7278).

   ### Fixed
   Fix the `Database::list_fields()` method (see #7277).

   ### Fixed
   Correctly assign "col_first" and "col_last" in the image gallery (see #7250).

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Nov 24 13:29:08 UTC 2014

   Modified Files:
   	pkgsrc/www/contao: Makefile.common
   	pkgsrc/www/contao32: distinfo

   Log Message:
   Update contao32 to 3.2.16, security release.

   Version 3.2.16 (2014-11-24)
   ---------------------------

   ### Fixed
   Fixed a potential directory traversal vulnerability.

   ### Fixed
   Fixed a severe XSS vulnerability. In this context, the insert tag flags
   `base64_encode` and `base64_decode` have been removed.

   ### Fixed
   Handle nested insert tags in strip_insert_tags().

   ### Fixed
   Correctly store the model in Dbafs::addResource() (see #7440).

   ### Fixed
   Send the request token when toggling the visibility of an element (see #7406).

   ### Fixed
   Always apply the IE security fix in the Environment class (see #7453).

   ### Fixed
   Correctly handle archives being part of multiple RSS feeds (see #7398).

   ### Fixed
   Correctly handle `0` in utf8_convert_encoding() (see #7403).

   ### Fixed
   Send a 301 redirect to forward to the language root page (see #7420).
Pullup ticket #4558 - requested by taca
www/contao33: security update

Revisions pulled up:
- www/contao/Makefile.common                            1.83,1.85 via patch
- www/contao33/Makefile                                 1.6
- www/contao33/PLIST                                    1.7
- www/contao33/distinfo                                 1.7-1.8

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sun Nov  2 01:19:55 UTC 2014

   Modified Files:
   	pkgsrc/www/contao: Makefile.common
   	pkgsrc/www/contao33: PLIST distinfo

   Log Message:
   Update contao33 to 3.3.6.

   Version 3.3.6 (2014-10-31)
   --------------------------

   ### Fixed
   Always pass a DC object in the `toggleVisibility` callback (see #7314).

   ### Fixed
   Correctly render the "read more" and article navigation links (see #7300).

   ### Fixed
   Fix the markup of the form submit button (see #7396).

   ### Fixed
   Do not generally remove insert tags from page titles (see #7198).

   ### Fixed
   Consider the `useSSL` flag of the root page when generating URLs (see #7390).

   ### Fixed
   Correctly create the template object in `BaseTemplate::insert()` (see #7366).

   ### Updated
   Updated TinyMCE to version 4.1.6 and added the "lists" plugin (see #7349).

   ### Fixed
   Fixed the FAQ sorting in the back end (see #7362).

   ### Fixed
   Added the `Widget::__isset()` method (see #7290).

   ### Fixed
   Correctly handle dynamic parent tables in the `DC_Table` driver (see #7335).

   ### Fixed
   Correctly shortend HTML strings in `String::substrHtml()` (see #7311).

   ### Updated
   Updated MooTools to version 1.5.1 (see #7267).

   ### Fixed
   Updated swipe.js to version 2.0.1 (see #7307).

   ### Fixed
   Use an `.invisible` class which plays nicely with screen readers (see #7372).

   ### Fixed
   Handle disabled modules in the module loader (see #7380).

   ### Fixed
   Fixed the "link_target" insert tag.

   ### Fixed
   Correctly mark CAPTCHA fields as mandatory (see #7283).

   ### Updated
   Updated the ACE editor to version 1.1.6 (see #7278).

   ### Fixed
   Fix the `Database::list_fields()` method (see #7277).

   ### Fixed
   Correctly assign "col_first" and "col_last" in the image gallery (see #7250).

   ### Fixed
   Set the correct path to TCPDF in `system/config/tcpdf.php` (see #7264).

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Nov 24 13:30:49 UTC 2014

   Modified Files:
   	pkgsrc/www/contao: Makefile.common
   	pkgsrc/www/contao33: Makefile distinfo

   Log Message:
   Update contao33 to 3.3.7, security release.

   Version 3.3.7 (2014-11-24)
   --------------------------

   ### Fixed
   Fixed a potential directory traversal vulnerability.

   ### Fixed
   Fixed a severe XSS vulnerability. In this context, the insert tag flags
   `base64_encode` and `base64_decode` have been removed.

   ### Fixed
   Handle nested insert tags in strip_insert_tags().

   ### Fixed
   Correctly store the model in Dbafs::addResource() (see #7440).

   ### Fixed
   Send the request token when toggling the visibility of an element (see #7406).

   ### Fixed
   Always apply the IE security fix in the Environment class (see #7453).

   ### Fixed
   Correctly handle archives being part of multiple RSS feeds (see #7398).

   ### Fixed
   Correctly handle `0` in utf8_convert_encoding() (see #7403).

   ### Fixed
   Send a 301 redirect to forward to the language root page (see #7420).
Pullup ticket #4559 - requested by morr
www/wordpress: security update

Revisions pulled up:
- www/wordpress/Makefile                                        1.43
- www/wordpress/distinfo                                        1.35

---
   Module Name:	pkgsrc
   Committed By:	morr
   Date:		Mon Nov 24 19:08:53 UTC 2014

   Modified Files:
   	pkgsrc/www/wordpress: Makefile distinfo

   Log Message:
   Security update to 4.0.1.

   Changes:
   - Three cross-site scripting issues that a contributor or author could use to
     compromise a site.
   - A cross-site request forgery that could be used to trick a user into changing
     their password.
   - An issue that could lead to a denial of service when passwords are checked.
   - Additional protections for server-side request forgery attacks when WordPress
     makes HTTP requests.
   - An extremely unlikely hash collision could allow a user’s account to be
     compromised, that also required that they haven’t logged in since 2008 (I
     wish I were kidding).
   - WordPress now invalidates the links in a password reset email if the user
     remembers their password, logs in, and changes their email address.

   More details on http://codex.wordpress.org/Version_4.0.1.
Pullup tickets #4555, #4556, #4557, #4558 and #4559.